Public env vars, the Supabase anon key, and row level security in Next.js
By ShipSecurely Editorial · Updated · How we make these guides
By default, Next.js exposes a browser value only when the name starts with NEXT_PUBLIC_ . A name without that prefix stays in the Node.js environment, so server code can read process.env.SUPABASE_SECRET_KEY .
Fix for Next.js
By default, Next.js exposes a browser value only when the name starts with NEXT_PUBLIC_. A name without that prefix stays in the Node.js environment, so server code can read process.env.SUPABASE_SECRET_KEY. The env option in next.config is separate: Next.js says a name listed there is included in the JavaScript bundle even without NEXT_PUBLIC_. Do not put a secret key in either place.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.